Hello everyone, and welcome to this lecture.
In this lecture we will try to identify and extract of hidden components with the built in tools that
comes with windows operating system.
Now, today, most the most common use for reverse engineering is targeting malware.
Like any other software, malware has its installation process.
Now the difference is that it does not ask for the user's permission to install, so malware does not
even install in the program files folder here under where it is supposed to.
Uh, so rather tends to install malware files in folders that are not commonly entered by the user,
making it hidden from being noticed.
However, some malware shows up, noticed, and generates copies of itself in almost all noticeable
folders such as desktop.
Now its purpose to get its copy is executed by users, by it, by accidental double clicking.
For a curiosity.
Like, for example, if I have the Android developers here, I can change the icon of this and just
double click it and the malware opens.
Now, this is not a malware here.
Now this is what we usually call malware presence persistence.
Its purpose is to get its copies executed by users, be it by accidental double click or by curiosity.
And also, uh, however, some malware shows up, uh, noticed and generated uh, copies, uh, making
it, um, hidden.
Uh, also almost undeletable.
Now, uh, the persistence in malware is when malware consistently runs in the background.
Now in this section, we will be pinpointing out general techniques used by malware to become persistent.
And we will also explain common locations where malware files are stored and major behaviors of malware,
and some tools that are capable of identifying how the malware installs itself in the system will also
be shown.
Now, understanding how malware is delivered will definitely help reverse engineer explain how the attacker
was able to deliver an attacker to compromise the system.
And in this section, we will learn about the basics of operating system environment, both the Windows
and Linux.
The typical malware behavior, which consists of malware delivery, malware persistence and malware
payload, and the tools used to identify hidden components.
Now, technical requirements of this lecture is mainly the built in windows tools.
We will use in this lecture, but you can also get the from the Microsoft website Sysinternals suite.
And here you will see mainly the troubleshooting utilities for the windows machine.
Yeah.
This tool set might become handy in some cases.
And yeah, since uh, let's let me download and let's talk about the operating system environment here.
So doing reverse engineering requires the analyst to understand where the software being reversed is
being run.
So the major parts that software requires in order to work in an operating system are the memory and
the file system in windows operating systems, beside the memory and the file system.
Microsoft introduced the registry system, which is actually stored in a protected files called Registry
Hives.
We will be looking at this registry editor more in next lectures, because this is very useful at identifying
and seeing the hidden traces of the malware and other programs, uh, be it the games, be it like other
office programs, even.
And the file system, the file system is where the data is stored directly to the physical drive.
Now, these file systems manage how files and directories are stored in the disk, and various disk
file systems have their own variations of efficiently, uh, reading and writing data.
Now there are different disk file systems such as the Just NTFS.
You can see here the fat, x2, x3, x4 for the Linux, ZFS and APFs for the Mac.
Now, common file systems used by the windows are NTFS and Fat32 for.
Now, if we open disk management that you see here, we can see our disk partitions and the disks.
You can see I have two disks.
And in the disk one I have 123 partition.
The one is EFI system partition which is common if you are using windows.
And this is the NTFS partition my See disk and it is a I, we also have the recovery partition.
Now you can see the disk zero.
We have 12 gigabyte NTFS volume volume label E and we have unallocated.
Partition.
So by right clicking on it you can generate The new partition.
You can see we can select the NTFS and Fat32.
We can also allocate unit size but default is okay in most cases.
Um now yeah.
Uh, now the stored in the file system is information, uh, about the directory path and files.
It includes the file name, size of the file and the date stamps and permissions.
You can see we also edit the permissions of this uh by the users and groups.
Now if we go to here and open the windows folder um and here you can see we have PFC, SFC.
Now this shows the information about the file system.
Uh, in about a, b, f, s, We see.
You can see it's a description.
Is boot file servicing utility location created modified and accessed just today.
And the compatibility details.
It is copyrighted Microsoft Corporation.
All rights reserved.
Product name is Microsoft Windows operating system.
So this.
Executable file seems okay because it is.
Uh, let's go through the little history here.
In our previous Apple Mac OS, X versions, file information and data are stored in a resource forks.
So resource forks are actually deprecated.
But backward compatibility still exists on recent versions of Mac OS.
So a file has two forks stored in the file system the data fork and resource fork.
Now the data fork contains unstructured data, while the resource fork contains structured data.
The resource fork contains information such as the executable machine, code icons, shape of an alert
box, strings used in the file, and so forth, so on.
Now, for instance, if you wanted to back up a mac application by simply moving it to Windows Hard
Drive, then moving it back, the application will no longer open.
So while transferring, the only file gets transferred, but the resource fork gets stripped out of
in the process.
Now, simply Copy tools doesn't respect the forks in Apple Mac OS.
Instead, Mac developers developed tools to synchronize files to and from external disk.
So yeah, windows is basically more handy and more compatible with the copying and extracting files.
Now we can copy this whole file into our desktop.
And yeah, here you can see it still works.
And, uh, yeah.
Let's, uh, talk about the memory as well.
Uh, now you can see we have the memory.
I have 32GB of Ram.
Now, this is my virtual machine.
In my main machine, I have 64GB of Ram.
Now, uh, when a windows executable executes, if you go to processes now, you can see the system
allocates a memory space.
For example, for the Google Chrome it is 125.
So it will also if you add the new tabs now you will see it will increase like 318 340.
Right.
Uh, it is, uh, about how efficient the program is written and what you do about the program.
It is how it defines the memory.
And now this reads executable file from the disk writes it at a predefined sections and allocated memory,
then loads the code to execute from there.
Now this block of memory is called the process block and is linked to other process blocks as well.
Basically, every program that executes consumes a memory space as a process.
You can see even as little as like zero megabytes.
Now, this is not a zero megabytes.
Of course it will have some kind of kilobytes and it will just use bits or bytes here, but not zero
kilobytes.
Now you can see in the system 0.1 1.11 to 2.
And yeah, that's how it is.
And you can see that the most.
Memory used as Google Chrome.
And the second is anti-malware executable Windows Defender.
Now this is the uh how you end create memory dump file.
Go to details open file location.
Now if you see some, uh Possible malware.
You can open file location and see where it is, where it is and what it does.
And yes, you can also execute the created memory dump file.
And you can see we have created this open file location.
And here we are.
Now this will be handy in after analyzing um and yeah the most important thing in the Linux is the registry
system.
So in windows uh, not Linux.
Sorry.
Uh, in windows in Linux we, we have no registry system.
It works uh, different uh, which I will explain also in next lectures.
Yeah.
In windows, uh, the registry is a common database that contains system wide configuration and application
settings.
Now examples of stored information, the registry.
Let's see.
Uh, so it shows the, uh, associated programs that executes specific files like Files like if we go
to default application.
Now if we see, for example, Google Chrome uses.
HTM HTML pdf.
Files.
We use the Foxit pdf reader.
So basically these settings store in the registry.
Right.
So for example the HTML files are associated with the Google Chrome PDF files are associated with Foxit
PDF reader.
And it will also save the associated icons uh and to specific files and folders.
It will also set the software settings like uh.
It can also set the uninstalling uh configurations, update sites, port ports, use product identification
uh numbers.
It will also use the uh.
It is also used to save the user uh settings.
Uh, like group profiles.
Uh, and it also saves the printer.
Uh, like, basically the registry is the memory.
The memory that saves everything, uh, in windows.
Uh, now the registry, you can see it is stored in a hive files.
Uh, the list of hive files is also found in the registry itself, as can be seen here.
Now, writing and reading information from the registry requires Windows Registry APIs.
Now, the registry can be, uh, visually using registry editor like this.
Uh, and on the left pane, the registry values are found under the name column.
And, uh, yes.
So for example, if we go to H key current user, uh, like uh go to software.
And here.
Let's see.
Python.
Core.
Now you can see the main Python documentation.
Yeah.
It has it is storing the something right.
Yeah.
The value data is here right.
It is like a variable right.
Executable path of the Python is here.
And uh, yes.
Uh, we will uh, we also I will also explain we will explain the registry editor in more detail, because
the editor is your friend that reverse engineering and malware analysis and, uh, yes.
Uh, that's that's it with our lecture.
Uh, thank you for watching.
And I'm waiting you.
In the next lecture, we will talk about the typical malware behavior like persistence.
Run keys for understanding the run keys.
We will also use the registry editor as well.
So I'm waiting you in the next lecture.